TvRMM maintains a SOC 2-aligned security readiness program so customers can review current hosted-service safeguards, readiness status, published evidence summaries, and assurance limits.
TvRMM is not currently SOC 2 audited. We are building and maintaining a SOC 2-aligned security program with an initial focus on Security, Availability, and Confidentiality. The materials in this public package are self-attested and provided for transparency. They are not a SOC 2 report, certification, or independent assurance opinion.
Last updated: 2026-07-10. This page reflects the published readiness evidence current on that date and is not an auditor-issued conclusion.
TvRMM publishes its security model, responsible disclosure path, subprocessor list, DPA, retention policy, and customer-facing support boundaries. The initial SOC 2-aligned governance baseline was approved on 2026-07-01, and the initial isolated restore validation was completed in July 2026.
The initial access review, backup evidence cycle, and isolated restore validation are complete. Current evidence collection covers CI and change management, critical-provider reviews, security testing, tenant isolation, and incident response.
The public summaries are self-attested and redacted. TvRMM is not currently SOC 2 audited, and these materials do not provide independent assurance or operating-effectiveness conclusions.
The readiness program focuses first on Security, Availability, and Confidentiality. The controls below state the commitments and operating practices available for customer review.
| Control area | Public summary |
|---|---|
| Access control | TvRMM's access-control standard requires named accounts, least privilege, MFA where supported, and periodic review for production and customer-data access. |
| Change management | Product changes are tracked in Git. The app repo uses CI validation, and hosted deployments are explicit operator actions. |
| Tenant isolation | The hosted app is designed around tenant and organization scoping, role-gated actions, and customer-approved support access. |
| Agent identity | Agents enroll into a customer context and use identity material to communicate with the service. |
| Endpoint actions | Scripts, terminal, patching, reboot, updates, cleanup, and remote access are treated as high-risk actions requiring authorization and auditability. |
| Secrets management | Operational secrets are stored outside source code and loaded into runtime and deployment workflows from approved secret stores. |
| Vulnerability management | Security findings from scans, tests, reviews, and reports are tracked to remediation or documented risk acceptance. |
| Incident response | TvRMM maintains an incident-response process for triage, containment, remediation, customer-impact review, and follow-up. |
| Backup and recovery | Production backups are automated and monitored. In July 2026, TvRMM completed an isolated restore validation that confirmed application health and controlled existing-agent reconnection without fresh enrollment. |
| Vendor management | Providers that process customer data or support production are inventoried and reviewed. |
| Data handling | Retention, export, deletion, and support-access expectations are tracked against public legal/security commitments. |
RMM software has unusual authority over endpoints. Our security program therefore covers both normal SaaS controls and the endpoint-management safeguards customers need to inspect before trusting the service.
TvRMM welcomes good-faith security reports. We ask researchers to report safely, avoid customer data, and stay inside the published research boundaries.
TvRMM asks researchers to allow a reasonable remediation period before public disclosure. A typical target is 90 days from acknowledgement, adjusted for severity and remediation complexity.
TvRMM maintains automated production backups and tested recovery procedures for the hosted service. This self-attested summary omits backup locations, credentials, recovery routing, and detailed internal topology.
| Area | Status |
|---|---|
| Production backup automation | Operating evidence confirms scheduled production database backups and backup-job monitoring. |
| Recovery validation | In July 2026, TvRMM restored production-derived backup data into a separate isolated target and validated application health. |
| Agent continuity | The isolated validation confirmed that a controlled existing agent could reconnect to the restored service using its existing identity, without fresh enrollment. |
| Cleanup | The temporary recovery target was removed after validation and the controlled agent returned to its normal operating path. |
| Recovery objectives | Internal recovery measurements are retained for readiness review. TvRMM does not publish or guarantee recovery-time or recovery-point objectives at this stage. |
TvRMM uses providers to host, secure, bill, monitor, deliver, and operate the service. The legal subprocessor page remains the policy source; this summary explains the same provider landscape in the context of security readiness.
| Provider | Purpose | Data involved |
|---|---|---|
| OVHCloud / OVH Proxmox and shared edge infrastructure | Hosted portal, agent check-in services, compute, storage, database, networking, package/installer hosting, monitoring, static website/help site, and public edge delivery. | Customer tenant data, endpoint data, operational records, logs, billing metadata, service telemetry, website request metadata, and release/download metadata. |
| Stripe | Checkout, payment processing, customer portal, invoices, refunds, payment status, and billing webhooks. | Billing metadata, payment status, customer identifiers, invoice and refund records. Stripe handles payment method details directly. |
| Cloudflare | DNS, domain security, edge routing, and email/contact routing where used. | DNS/routing metadata, security logs, and contact-routing metadata where applicable. |
| GitHub | Source control, issue/PR workflow, release automation, and CI/CD operations. | Source code, deployment metadata, operational artifacts, and issue/support context when intentionally added. |
| vanRoojen LLC operated analytics | Privacy-conscious product-site analytics. | Page views, referrers, device/browser metadata, and approximate analytics data. |
This status view distinguishes the completed foundation, current evidence collection, RMM-specific controls, public trust-center scope, and potential future assurance stages.
The program foundation is complete for the initial readiness cycle. TvRMM has approved its system scope, core policy set, control matrix, SOC 2 readiness mapping, control ownership, evidence templates, and initial risk register. The governance baseline is included in the public evidence index.
Operating-evidence collection is in progress. The initial cycle includes access-review evidence, CI and change-management evidence, backup and monitoring evidence, and an isolated restore validation completed in July 2026. Current collection continues across critical-vendor reviews, security testing, and tenant-isolation evidence.
Current RMM-specific control work covers endpoint-action authorization and audit evidence, database-backed tenant-isolation testing, support and break-glass access records, agent identity lifecycle evidence, and sensitive command-output handling.
The public trust center provides TvRMM's self-attested security overview, vulnerability-disclosure guidance, public control summary, evidence index, backup and recovery summary, and subprocessor information. Published summaries remain self-attested and exclude private evidence.
| Potential future assurance stages |
|---|
| third-party readiness assessment |
| SOC 2 Type 1 |
| SOC 2 Type 2 after an observation period |
This index lists published, redacted, self-attested evidence summaries. It contains no links to private evidence packages. Raw logs, customer names, secret values, non-public operations details, and unredacted screenshots are excluded.
| Evidence ID | Control area | Public status | Summary location | Last reviewed |
|---|---|---|---|---|
| EVID-2026-07-01-003 | Governance baseline | Published | Initial SOC 2-aligned system scope, policy set, control matrix, readiness mapping, and control-owner model approved on 2026-07-01. This is governance design evidence, not operating-effectiveness evidence or independent audit evidence. | 2026-07-01 |
| EVID-2026-07-09-001 | Backup and recovery | Published | Isolated restore validation completed using production-derived backup data. The restored service passed application-health checks, and a controlled existing agent reconnected without fresh enrollment. This is self-attested operating evidence, not a full production failover or independent assurance. | 2026-07-10 |
This page supports customer due diligence while stating the program's current audit status, evidence basis, and limitations directly.
TvRMM is not currently SOC 2 audited. This page is not a SOC 2 report, certification, or independent assurance opinion.
TvRMM provides this self-attested view of its current security readiness using redacted public summaries and measured implementation claims.
Public claims remain matched to current implementation and approved evidence. Published summaries omit sensitive operational details.